Audit Process Design

With no existing documentation to start from, we went directly to the source. We ran contextual inquiry sessions sitting alongside auditors during real engagements, watching how they worked, what tools they used, and where things broke down.

10 interviews across experience levels, senior auditors running full engagements and junior auditors doing the fieldwork. The gap between them was striking: seniors had years of process knowledge in their heads that had never been written down, and juniors had no way to access it.

From the research we built two personas: a senior auditor with 8+ years across SOC 1, SOC 2 and HITRUST, and a junior auditor two years in who was still figuring things out mostly by asking around.

We went through all the research and pulled out what people actually needed. A clear process reference for each audit type, a place to find past work, and a better sense of what done looks like at each stage.

We translated auditor needs into product user stories, written from the auditor’s point of view and tied to specific stages of the process. This gave the product team something concrete to build from.

We built individual service blueprints for SOC 1, SOC 2 and HITRUST, mapping every step across four swim lanes: client actions, frontstage auditor, backstage auditor, and support processes. This was the first time any of it had been written down.

We ran workshops with PMs, engineers and auditors to walk through the blueprints together. For a lot of people in the room, it was the first time they had seen the full process end to end. It brought up a lot of things that had been blocking product decisions without anyone realizing why.

We put together a living document for the product team with all audit internal processes organized by type and stage. Something they could actually reference and keep updating over time.